Security readout for executives and security teams
Plain-English summary
This flaw lets a pod on some SELinux-enabled containerd hosts gain read and write access to privileged host files it should not control. The impact can be severe for affected Kubernetes nodes, but the conditions are specific and the public bundle does not show active exploitation.
Executive priority
Treat as a high-priority platform patch for affected container infrastructure. It can undermine host isolation on qualifying nodes, but urgency should focus on environments matching the SELinux, containerd version, and CRI conditions rather than all container deployments.
Technical view
containerd CRI versions 1.5.0 through before 1.5.9 improperly relabeled certain hostPath-mounted files on SELinux systems. The relabeling matched the container process label, allowing access to privileged regular files and creating host confidentiality, integrity, and availability risk.
Likely exposure
Exposure is most likely on SELinux-enabled Linux nodes, including EL8-family systems, Fedora, and SUSE MicroOS, using affected containerd versions as the CRI runtime. Systems not using SELinux or not in the affected version range are not indicated as affected by the supplied sources.
Exploitation context
The source bundle describes a pod-based attack path requiring specific hostPath behavior on an affected node. CISA KEV is false and no cited source in the bundle confirms active exploitation. The CVSS vector rates attack complexity and privileges as high.
Researcher notes
Root cause is improper permission preservation through SELinux relabeling of container file mounts. The fix is linked to upstream containerd changes and version 1.5.9. Evidence does not establish broad product impact beyond containerd or confirm exploitation in the wild.
Mitigation direction
- Upgrade containerd to version 1.5.9 or later.
- Apply relevant distribution security updates, including Fedora advisories where applicable.
- Prioritize SELinux-enabled Kubernetes nodes using containerd as CRI.
- Temporarily reduce exposure from hostPath-using pods until patched.
- Check vendor guidance for platform-specific package names and rollout steps.
Validation and detection
- Inventory node containerd versions and flag 1.5.0 through 1.5.8.
- Confirm whether SELinux is enabled on container hosts.
- Identify Kubernetes nodes using containerd as the CRI runtime.
- Review workloads or policies permitting hostPath volumes.
- Verify patched nodes report containerd 1.5.9 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-281: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-43816 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H1.36Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8HighVector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9cCVE reference · x_refsource_CONFIRM
- https://github.com/containerd/containerd/issues/6194CVE reference · x_refsource_MISC
- https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eeaCVE reference · x_refsource_MISC
- https://github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299CVE reference · x_refsource_MISC
- FEDORA-2022-f668c3d70dCVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-a0b2a4d594CVE reference · vendor-advisory, x_refsource_FEDORA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Preservation of Permissions
Improper Preservation of Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.